Various issues encountered during installation

[jojo786]

Here's a summary of all the issues encountered during installation:

1. IAM Trust Policy — The execution role had bedrock.amazonaws.com but AgentCore CLI
   requires bedrock-agentcore.amazonaws.com. Fixed by adding the missing service
   principal.
2. Missing tsc command — TypeScript compiler wasn't installed globally. Fixed with
   npm install -g typescript.
3. TypeScript version too new — Installed TS 7.x which deprecated moduleResolution:
   "Node". Fixed by downgrading to npm install -g typescript@5.
4. Missing npm dependencies in agentcore/cdk/ — The CDK project inside
   agentcore/cdk/ hadn't had npm install run. Fixed with cd agentcore/cdk && npm
   install.
5. Conflicting agentcore CLIs — A Python-based agentcore (from pip) was shadowing
   the Node.js one in PATH due to the activated venv. Fixed by using the full path or
   aliasing the Node.js version.
6. Telegram user not in allowlist — DynamoDB identity table was empty. Fixed by
   adding a ALLOW#telegram:{user_id} item.
7. Lambda can't decrypt Secrets Manager (KMS AccessDenied) — The router Lambda role
   lacked KMS Decrypt permission on the key encrypting the Telegram bot token. Fixed
   with kms create-grant.
8. Invalid Telegram bot token — The stored secret was garbage (32 chars, wrong
   format). Fixed by putting the real BotFather token into Secrets Manager.
9. Lambda caching stale token — After updating the secret, the Lambda container
   still used the old cached value. Fixed by updating the Lambda env vars to force a
   cold start.
10. AgentCore read timeout — Boto3's default 60s read timeout was too short for
    AgentCore responses. Fixed by setting read_timeout=110 in the client config.